Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 04:01

General

  • Target

    dd98b4b383278ba555167eafe975d259bd492bc9f3df33231b358fb5f4bb0d1c.exe

  • Size

    1.8MB

  • MD5

    f04b3373ae5c6188c50c1dc9cbb47d5f

  • SHA1

    ffcfbcbb82ad2785140e8c9e15437caae75f5e51

  • SHA256

    dd98b4b383278ba555167eafe975d259bd492bc9f3df33231b358fb5f4bb0d1c

  • SHA512

    61e76dafff39ee952d66c606b890f771d1a88a5e5fa4ab812f465936da5470bbde90f5f408dafbd75d419622bd170a1d9fe4661df5b545d0e546f80609bf95b7

  • SSDEEP

    24576:1rvlKtCVXdWSpG3nr7m+989JSDLR1c0x9lL/ligQkQ247o0o7GW4ZnBG1ToYVnHL:1rdXkSUxGvDm9lxjTV0o7io1tTWgYCb

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd98b4b383278ba555167eafe975d259bd492bc9f3df33231b358fb5f4bb0d1c.exe
    "C:\Users\Admin\AppData\Local\Temp\dd98b4b383278ba555167eafe975d259bd492bc9f3df33231b358fb5f4bb0d1c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Users\Admin\AppData\Local\Temp\1000036001\4540b9f84e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\4540b9f84e.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3176
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:540
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:696
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4920
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                  6⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:3384
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abb5ad8b-5324-4e8e-91d3-5c728ee4abdd} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" gpu
                    7⤵
                      PID:4420
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f56a527-898e-45a0-8ae8-a54bc1e3f469} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" socket
                      7⤵
                        PID:3316
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2740 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3152 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f072bf1c-1fc3-40c5-9f46-f2c596f4c637} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" tab
                        7⤵
                          PID:2504
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3680 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c776dfda-d536-4358-b3a2-577b3c1f468a} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" tab
                          7⤵
                            PID:2536
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4296 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4324 -prefMapHandle 4316 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e52317dd-b9b0-4728-b7f6-258238194d56} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" utility
                            7⤵
                            • Checks processor information in registry
                            PID:5288
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5376 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77ae3a8e-8dce-4d8e-9d74-2ff8e23a5f60} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" tab
                            7⤵
                              PID:5900
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1b29046-f24c-40f6-99f0-db811578d667} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" tab
                              7⤵
                                PID:5912
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {533ffc38-daa9-4aba-9b63-66d0d5bb0267} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" tab
                                7⤵
                                  PID:5924
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6316 -childID 6 -isForBrowser -prefsHandle 6228 -prefMapHandle 6240 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c69dd901-2177-4d18-b279-6927a168f35d} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" tab
                                  7⤵
                                    PID:1156
                          • C:\Users\Admin\1000037002\9706fcd865.exe
                            "C:\Users\Admin\1000037002\9706fcd865.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3960
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:4784
                          • C:\Users\Admin\AppData\Local\Temp\1000038001\d4f7c40209.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000038001\d4f7c40209.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2936
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3044
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1104

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\1000037002\9706fcd865.exe

                        Filesize

                        206KB

                        MD5

                        493ca2c6a90f04fb410bc18dfd958f53

                        SHA1

                        73482091cc88709902cc09aa8b164c9268b6e9cc

                        SHA256

                        b7fc4aa9feba9ee8c2307ec6d55b9010b9e8d2a50b2949dcd02cb6f6c3f7eece

                        SHA512

                        41f4a31c9dcda2816e93b7fc259f3546439bc6eedc5e02aef46eb91b960b6132af6c4bd2f6f5c9fe0b19f2083d45ba9620a15ea72a0abdaeabc527831bbc2b82

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                        Filesize

                        13KB

                        MD5

                        22b93bb4b5a5ec6fe9aea8c39e0a2c1e

                        SHA1

                        5f326d76769a4f9e6df42bd577e946e381649010

                        SHA256

                        22a19ed6fa05279ceaf5b1fb022af28597bdb610f89e8aec8389e30b7557a891

                        SHA512

                        94335961bd2a74da25f515f48cc1aed68939a9473604713f2caabf6b25038cb0e8cb27da2db111d64a28c686f3250d9462a6deed6bc246c7a90f8d9354ade2b6

                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                        Filesize

                        1.8MB

                        MD5

                        f04b3373ae5c6188c50c1dc9cbb47d5f

                        SHA1

                        ffcfbcbb82ad2785140e8c9e15437caae75f5e51

                        SHA256

                        dd98b4b383278ba555167eafe975d259bd492bc9f3df33231b358fb5f4bb0d1c

                        SHA512

                        61e76dafff39ee952d66c606b890f771d1a88a5e5fa4ab812f465936da5470bbde90f5f408dafbd75d419622bd170a1d9fe4661df5b545d0e546f80609bf95b7

                      • C:\Users\Admin\AppData\Local\Temp\1000036001\4540b9f84e.exe

                        Filesize

                        1.2MB

                        MD5

                        0268fe10bef3ec38e53e6a393558b6ce

                        SHA1

                        9ab70efc9284b4a0bb4dd3f816e5070c2c8f6fd0

                        SHA256

                        4f3605d6a7478c3de5bec04d779793e16c141d0f377f2246d1007f843268c31b

                        SHA512

                        4357851b65a41c5a3d22ad9b864f163dcaba290bf11d306589dca65cead0ae7d336c732120582bcec1e6b5b9f9f201d5488b75b8966cc9a076bb9d55af1ebbb4

                      • C:\Users\Admin\AppData\Local\Temp\1000038001\d4f7c40209.exe

                        Filesize

                        187KB

                        MD5

                        278ee1426274818874556aa18fd02e3a

                        SHA1

                        185a2761330024dec52134df2c8388c461451acb

                        SHA256

                        37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                        SHA512

                        07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                        Filesize

                        10KB

                        MD5

                        90fee4e5cda9fea897c27dc3b5656210

                        SHA1

                        4a73dbf8db7a98e1a7662ca64d2774e160e0e75a

                        SHA256

                        b561b785ef42c6139653c801c5e03ebd32ec69e7d15de6c44407cbccbc1e7451

                        SHA512

                        49c10374d7c4513513c58947ced46584fe5a77903e36e0e3dea3c971eb86061cdff191dd8e9bc94de38c60c27f5fadc43ace1d1d4491b89c4b52ebda36716459

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                        Filesize

                        16KB

                        MD5

                        9f2a47d2c847e2d3d3c5a0ea93f4c5bf

                        SHA1

                        8f5258b5794df32f72fd17483ac9ac5dcfe5dbfe

                        SHA256

                        43900d218982984fbef6c6eab04430979ce8cc0c8402a9656d02e5851ca8c227

                        SHA512

                        dded8eef9be8cb88618f240c3f9e507814d298af6fb4aced6f4d61835e7e812116babfaf1a6bef689176024c0bae4365255654ec9cf0235e0f60a3ea6d8b7bea

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        2f2869fba349258385c2f20920225f8c

                        SHA1

                        d464d1a31ef64140d7006fce357584205edf4c28

                        SHA256

                        1384f3a7543c4cd4b4072bc42c79a46c7d080dbf7a4b1031c3de8859865c6782

                        SHA512

                        be75d202ecc52a1b6422ae6583aed4f33961f47bacc0bfa05701b046ad5eb1793698027e195040c361c7808a0a3686813a39f41dc059c9feb3fbc3e090c799ac

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        16KB

                        MD5

                        90f238a24f5e2dbbc0b8d7effa273273

                        SHA1

                        5ce9d162201f079af2b9e6f610f2bdefed9a8aec

                        SHA256

                        8b1440ab28efec731898f8ef3a89f7b24b47194fbfbb33baa5fbe57e42a88e40

                        SHA512

                        acc8d417f9e7f23d134f4400511bb78d2910158cb1d184a4d31ea452986e63e8a51b9fcc55e93fd1134d248dcea288fb68f297e99ae715920c1e22fc3788048d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\606bed6b-78db-4e97-b48b-db2e16088cfb

                        Filesize

                        26KB

                        MD5

                        be75f6bf8e72c756ed113d58bf134153

                        SHA1

                        a83af50bcd9be46942599773ee4def5ba79e78fc

                        SHA256

                        7b5c53981ab0e23d499d0c32e6a5cdaff2606d58d92a5d54d1b45bdfcb2654f6

                        SHA512

                        7c256adfb67b29637752d0f3f3cca0cd185de516994e46862ea022d8d4d30ffba57f0bc90212b9172bb639755ef8bba3e605165ae74a10d8d7d760c2e23aad92

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\92e2d086-9eb1-46eb-b2ed-1d08f873b89e

                        Filesize

                        982B

                        MD5

                        ebcb01d8996c2016440c2a67b8a1c2f9

                        SHA1

                        79b8abe81bea73dd6170c14ad20fe926c497c56d

                        SHA256

                        9e33a9f743436f991af31b11fb9454f1727fb8a1aa9140b0948fff5448d1f6e8

                        SHA512

                        d261a1496406e63b5b16fe33476fb262225d170e63ad8f05e0eb3abf2c056859b129ef96463cb6bdcf5b597a79d3355957bcb84608d619ad7f07d6ef55859b6a

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\a67532c0-bcc0-47ac-b4f5-e1299904c335

                        Filesize

                        671B

                        MD5

                        710a9ed7a71d386fbe4da395811d997e

                        SHA1

                        4bc0c2cf577776b98a2e8b81337e56658cae63f3

                        SHA256

                        8c20ec51dc01a7acb6acca7ddc25bb9be8646403247b640ec2f5979bfd07d7c6

                        SHA512

                        3d19ee3b50d9217ab9b3396f478b9833e1ff7c0c8eb7064ce3c9ef0442f24445b9bad5a5fb4a79d51e660f0b7d12a9397677c9278fd5ac3808ac153588429e45

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                        Filesize

                        12KB

                        MD5

                        8ab61edb804fb7c7489d0dfb8acf4d52

                        SHA1

                        8e95556894ffedc924e17cb38c3afd6fc11ebe8e

                        SHA256

                        e3b12671878d0a1b26fd687cc85a15bbd897e3d0e0c5b1ff43ae62ec39c0c9eb

                        SHA512

                        8f1eca52286ec9fbab5aa049389f6d7d640bb50e3b7973eef83a41be81f1e7aa85662dfafd565a97c622b304e9c5f0e1816d4ca1be51315a6cd02ebc8a2fefba

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                        Filesize

                        16KB

                        MD5

                        aeabbc822505332d02b049b9d1c70b05

                        SHA1

                        4e357d673e5facf2e38999b50c6013f024814905

                        SHA256

                        bc23e3c8f614b27d585230833387296229411a8663ca62c2b84645bc03ef56b8

                        SHA512

                        4dd616c786845b5c108de117d005ecf76231c87b21191b9017799310fe7d50f104af42ae2a51a6679592245b7726e83264890ac86cf4b3796020769b53625963

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        5KB

                        MD5

                        db9114a1e8a5d62ee85db281bd5f44fc

                        SHA1

                        8612f03d39fc02a5faab263bb900d7bf46b72734

                        SHA256

                        b61d59ce353f589f4d97c12f1b73e24dfe1c55449ff6af6bdd172ff6548041d8

                        SHA512

                        cb104703957571e34311c3557478a1ae96b97e4ee8c2765c3175745629d50ba3611f446ec648bf968d242fc02cb092823c45f11d0d713fc38a386de3f134e88e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        1.4MB

                        MD5

                        97fee50395e793d1395391596f6ae518

                        SHA1

                        e32a9386624634689eb0dabf6bc547e20eb77933

                        SHA256

                        3aff9ccea4d38404fef73a573cf93911e5915ac60fe857a74956f088edfce530

                        SHA512

                        9431dcdf6b6262a418143dc2dfebe559c4eb1f3ea5774e96ebf3a92d2db97d7c3c05baf20edddab96cfbb07f6869a889dc050dff87fe453b5d21735538db58b2

                      • memory/696-46-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/696-44-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/696-48-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1104-2693-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/1104-2692-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/1156-1-0x0000000077D34000-0x0000000077D36000-memory.dmp

                        Filesize

                        8KB

                      • memory/1156-2-0x0000000000CF1000-0x0000000000D1F000-memory.dmp

                        Filesize

                        184KB

                      • memory/1156-0-0x0000000000CF0000-0x00000000011A4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/1156-3-0x0000000000CF0000-0x00000000011A4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/1156-4-0x0000000000CF0000-0x00000000011A4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/1156-18-0x0000000000CF0000-0x00000000011A4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-446-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-392-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-454-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2703-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2702-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2696-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-22-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-21-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-20-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-19-0x0000000000501000-0x000000000052F000-memory.dmp

                        Filesize

                        184KB

                      • memory/2204-439-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-17-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2695-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2694-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-436-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-447-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2690-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2689-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-924-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-1595-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2551-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2204-2685-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2604-41-0x000000007394E000-0x000000007394F000-memory.dmp

                        Filesize

                        4KB

                      • memory/2604-42-0x00000000007A0000-0x00000000008D0000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2936-344-0x0000000000590000-0x00000000007D3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2936-294-0x0000000000590000-0x00000000007D3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/3044-754-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/3044-752-0x0000000000500000-0x00000000009B4000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/3960-67-0x0000000000810000-0x0000000000848000-memory.dmp

                        Filesize

                        224KB

                      • memory/4784-69-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/4784-71-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB